没技术的过AVIRA和BD

wangjay1980

看来是过了

king6808

已删除：木马程序 Trojan-Downloader.Win32.Agent.dqr        文件: F:\9.30\1.zip/1.exe

promised

C:\ABC\1.zip:\1.exe - 特征码 'Trojan-Downloader' 被发现

changzheng2

eSafe  Win32.Agent.dqr
Fortinet  W32/Agent.DQR!tr.dldr
Jiangmin  Trojan/Agent.tmx
AVG  Agent.IIS
Kaspersky  Trojan-Downloader.Win32.Agent.dqr
Panda  Suspicious file
VBA32  Trojan-PSW.Game.63 (paranoid heuristics) (suspicious)
Sophos  Mal/Behav-119
Avira  TR/Dldr.Agent.dqr
Norman  W32/Agent.COUS
Avast!  Win32:Agent-HFX [Trj]
NOD32  probably a variant of Win32/Agent.NEO trojan
Ikarus  Trojan-Downloader
F-Secure  Trojan-Downloader.Win32.Agent.dqr
Webwasher  Trojan.Dldr.Agent.dqr
Dr.web  BACKDOOR.Trojan
Prevx1  Heuristic: Suspicious Self Modifying File

★1.exe :
    ☆SB name: W32/Malware
    ☆Compressed: YES

★[ GNR  info ]
    ☆* File might be compressed.
    ☆* Drops files in %WINSYS% folder.
    ☆* Creating several executable files on hard-drive.
   
  ★[ Changes to filesystem ]
    ☆* Creates file C:\WINDOWS\SYSTEM32\406EA57C.EXE.
    ☆* Creates file C:\WINDOWS\SYSTEM32\del.bat.
    ☆* Creates file C:\WINDOWS\SYSTEM32\94CE92A5.DLL.

★[ Changes to registry ]
    ☆* Creates key "HKLM\System\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\406EA57C.EXE -C15C73D0" in key "HKLM\System\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "DisplayName"="C15C73D0" in key "HKLM\System\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "Description"="94CE92A5" in key "HKLM\System\CurrentControlSet\Services\C15C73D0".
    ☆* Creates key "HKCU\Software\SYSTEM\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "Description"="94CE92A5" in key "HKCU\Software\SYSTEM\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "DisplayName"="C15C73D0" in key "HKCU\Software\SYSTEM\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "ErrorControl"="
" in key "HKLM\System\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "ImagePath"="C:\WINDOWS\SYSTEM32\406EA57C.EXE -C15C73D0" in key "HKCU\Software\SYSTEM\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "ObjectName"="LocalSystem" in key "HKLM\System\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "ObjectName"="LocalSystem" in key "HKCU\Software\SYSTEM\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "Start"="" in key "HKLM\System\CurrentControlSet\Services\C15C73D0".
    ☆* Sets value "Type"="" in key "HKLM\System\CurrentControlSet\Services\C15C73D0".

★[ Process&window info ]
    ☆* Enumerates running processes.
    ☆* Attempts to access service "C15C73D0".
    ☆* Creates service "C15C73D0 (C15C73D0)" as "C:\WINDOWS\SYSTEM32\406EA57C.EXE -C15C73D0".
    ☆* Enumerates running processes several parses....